Found via bughunter loading http://www.sony.co.in/bravia-lcd-tv/range/X9004-Series/562830 on nightly windows trunk debug build results in Assertion failure: JS_ObjectIsFunction(0, this), at c:\work\mozilla\builds\nightly\mozilla\js\src\jsfun.h:354 working on getting testcase and regression range but seems this is not fixed by bug 825705

working on it, so far its very hard to get a local testcase, but working on it

Judging from the stack, this could be an IM bug. There's some stuff for js::ion::InlineFrameIteratorMaybeGC for instance.

Yeah it's probably a duplicate of bug 883973. Tomcat, can you verify this no longer reproduces with m-c tip?

Jan, yeah can confirm its fixed on mozilla-central (no wonder i was not able to crash when trying to create a testcase yesterday :) thanks jan! Shall i resolve this as duplicate of bug 883973?